topic Re: Missing function Virus Total check in Cortex XDR Discussions

Missing function Virus Total check

RFeyertag — Mon, 08 Aug 2022 13:05:33 GMT

Hello dear community,

since today we are missing the point of departure virustotal in the APP GUI.

It is not possible to launch this function in the incident anymore. Except via Quick Launcher. Is this a bug or a feature?

Rob

Re: Missing function Virus Total check

SilviuMihailDascalu — Mon, 08 Aug 2022 13:16:51 GMT

Hi @RFeyertag,

Looking into the picture you've sent it doesn't look like you have a proper result from Virustotal and that option will be hidden by default.

Thanks,

Silviu

Re: Missing function Virus Total check

RFeyertag — Mon, 08 Aug 2022 14:15:00 GMT

Hello Silviu,

i forgot to mention, that we have not connected virustotal through API. Before 3.4 it was possible to fire the virustotal hashcheck through clicking on VT unknown. Then it opened the Virustotal page.

Is this change somewhere documented?

Rob

Re: Missing function Virus Total check

SilviuMihailDascalu — Mon, 08 Aug 2022 17:08:15 GMT

No, I couldn't find a change being documented so after talking with our Product Management team they have suggested to create a support ticket with our Customer Support team.

Re: Missing function Virus Total check

MartinPfeil — Tue, 09 Aug 2022 07:28:09 GMT

I noticed the same issue, the Virustotal link is gone from the "Key Assets and Artifacts" view. It is still available in the QuickLauncher menu which is another extra step to investigate a suspicious file.

Re: Missing function Virus Total check

eluis — Tue, 09 Aug 2022 09:49:02 GMT

Hi have you checked if you have the VT key properly configured ? KR Luis

Re: Missing function Virus Total check

P.Jacob — Tue, 09 Aug 2022 11:57:06 GMT

my VT is now back today... except It won't let me click on it to hyperlink me to the VT site. yesterday it was missing I have not changed anything.

Re: Missing function Virus Total check

RFeyertag — Tue, 09 Aug 2022 13:16:39 GMT

Hey @P.Jacob : still no changes, hosted in GER.

Re: Missing function Virus Total check

creddy — Sat, 20 Aug 2022 14:27:30 GMT

Hi @RFeyertag
Just crossing through this question, felt like you still need help on this query.

From XDR 3.4 version, Virus total option will not be displayed in Key Assets and Artifacts section. It will appear only when you have integrated the virus total with API key in XDR Settings as per below article.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash

I hope that answers your query.
Please mark this as solution if you find it helpful.
Thank you!

Re: Missing function Virus Total check

Cyber1985 — Sun, 21 Aug 2022 22:22:00 GMT

OK thank you! Do have customers Setup this VT API, even if they do not have an paid VT account?

Rob

Re: Missing function Virus Total check

creddy — Mon, 22 Aug 2022 02:30:52 GMT

@Cyber1985
No, I believe its not possible.
Refer below for more details.
https://developers.virustotal.com/reference/overview#search

https://support.virustotal.com/hc/en-us/articles/115002119845-What-is-the-difference-between-the-public-API-and-the-private-API-

I hope that answers your query.
Please mark this as solution if you find it helpful.
Thank you!